{"ip":"45.157.112.135","total_events":26,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"18+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 18 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"11,808 bytes sent","bytes_sent":11808,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-11T06:58:56","last_seen":"2026-08-11T08:59:07","events_24h":0,"events_7d":26,"geo":{"country_code":"FR","country_name":"France","region":"Île-de-France","city":"Paris","lat":48.8558,"lon":2.3494,"asn":206092,"org":"F.n.s. Holdings Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":5099,"proto":"tcp","label":"","count":2},{"port":5091,"proto":"tcp","label":"","count":2},{"port":5098,"proto":"tcp","label":"","count":2},{"port":5086,"proto":"tcp","label":"","count":2},{"port":5095,"proto":"tcp","label":"","count":2},{"port":5087,"proto":"tcp","label":"","count":2},{"port":5082,"proto":"tcp","label":"","count":2},{"port":5094,"proto":"tcp","label":"","count":2},{"port":5097,"proto":"tcp","label":"","count":1},{"port":5089,"proto":"tcp","label":"","count":1},{"port":5080,"proto":"tcp","label":"","count":1},{"port":5085,"proto":"tcp","label":"","count":1},{"port":5092,"proto":"tcp","label":"","count":1},{"port":5090,"proto":"tcp","label":"","count":1},{"port":5084,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-11","count":26}],"recent_events":[{"timestamp":"2026-08-11T08:59:07","port":5094,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=1130bd45a\r\nVia: SIP/2.0/TCP 10.116.4.57:60364;branch=z9hG4bK-d87543-221383130-1--d87543;rport\r\nCall-ID: f479feaa91304824913e637c81c56d87\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@10.116.4.57:60364>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d3131333062643435610d0a5669613a205349502f322e302f5443502031302e3131362e342e35373a36303336343b6272616e63683d7a39684734624b2d6438373534332d3232313338333133302d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2066343739666561613931333034383234393133653633376338316335366438370d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130304031302e3131362e342e35373a36303336343e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"40882ef1-6001-475c-b446-5b839456784a","seq":1,"duration_ms":100,"bytes_in":456,"bytes_out":14,"enriched":{"digest":"a7d2d2188e8545af","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=1130bd45a","Via: SIP/2.0/TCP 10.116.4.57:60364;branch=z9hG4bK-d87543-221383130-1--d87543;rpo…","Call-ID: f479feaa91304824913e637c81c56d87","CSeq: 1 REGISTER","Contact: <sip:100@10.116.4.57:60364>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["10.116.4.57"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-11T08:53:15","port":5093,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=04e9e2414\r\nVia: SIP/2.0/TCP 10.116.4.57:59843;branch=z9hG4bK-d87543-604485240-1--d87543;rport\r\nCall-ID: 972774a1e252486aadae85e8f2177670\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@10.116.4.57:59843>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d3034653965323431340d0a5669613a205349502f322e302f5443502031302e3131362e342e35373a35393834333b6272616e63683d7a39684734624b2d6438373534332d3630343438353234302d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2039373237373461316532353234383661616461653835653866323137373637300d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130304031302e3131362e342e35373a35393834333e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"b0c965cc-26f2-4912-9898-54a3467cd207","seq":1,"duration_ms":100,"bytes_in":453,"bytes_out":14,"enriched":{"digest":"2c5c47445d267d8a","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=04e9e2414","Via: SIP/2.0/TCP 10.116.4.57:59843;branch=z9hG4bK-d87543-604485240-1--d87543;rpo…","Call-ID: 972774a1e252486aadae85e8f2177670","CSeq: 1 REGISTER","Contact: <sip:100@10.116.4.57:59843>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["10.116.4.57"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-11T08:52:28","port":5089,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=9be79af3d\r\nVia: SIP/2.0/TCP 10.116.4.57:54493;branch=z9hG4bK-d87543-914117721-1--d87543;rport\r\nCall-ID: 6b2c522ce2b549b6a74db8768fd4cb45\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@10.116.4.57:54493>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d3962653739616633640d0a5669613a205349502f322e302f5443502031302e3131362e342e35373a35343439333b6272616e63683d7a39684734624b2d6438373534332d3931343131373732312d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2036623263353232636532623534396236613734646238373638666434636234350d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130304031302e3131362e342e35373a35343439333e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"b3124a6f-0623-44bd-a97d-b1681c57e0fd","seq":1,"duration_ms":100,"bytes_in":453,"bytes_out":14,"enriched":{"digest":"d4b56f4e36f1bcfa","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=9be79af3d","Via: SIP/2.0/TCP 10.116.4.57:54493;branch=z9hG4bK-d87543-914117721-1--d87543;rpo…","Call-ID: 6b2c522ce2b549b6a74db8768fd4cb45","CSeq: 1 REGISTER","Contact: <sip:100@10.116.4.57:54493>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["10.116.4.57"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-11T08:52:01","port":5094,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=c0fff55a1\r\nVia: SIP/2.0/TCP 10.116.4.57:61101;branch=z9hG4bK-d87543-233256910-1--d87543;rport\r\nCall-ID: 82781b651e8b41a0a2b3b779a807a9f2\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@10.116.4.57:61101>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d6330666666353561310d0a5669613a205349502f322e302f5443502031302e3131362e342e35373a36313130313b6272616e63683d7a39684734624b2d6438373534332d3233333235363931302d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2038323738316236353165386234316130613262336237373961383037613966320d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130304031302e3131362e342e35373a36313130313e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"fdff090f-d564-4b17-ba1e-43dd22bdf99b","seq":1,"duration_ms":100,"bytes_in":453,"bytes_out":14,"enriched":{"digest":"a899dafbccc70fa4","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=c0fff55a1","Via: SIP/2.0/TCP 10.116.4.57:61101;branch=z9hG4bK-d87543-233256910-1--d87543;rpo…","Call-ID: 82781b651e8b41a0a2b3b779a807a9f2","CSeq: 1 REGISTER","Contact: <sip:100@10.116.4.57:61101>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["10.116.4.57"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-11T08:50:00","port":5099,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=2ca0b6057\r\nVia: SIP/2.0/TCP 10.116.4.57:64911;branch=z9hG4bK-d87543-103883201-1--d87543;rport\r\nCall-ID: 36ee314175a64537a5459f383d1ca723\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@10.116.4.57:64911>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d3263613062363035370d0a5669613a205349502f322e302f5443502031302e3131362e342e35373a36343931313b6272616e63683d7a39684734624b2d6438373534332d3130333838333230312d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2033366565333134313735613634353337613534353966333833643163613732330d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130304031302e3131362e342e35373a36343931313e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"8b5dd0f1-21f2-4942-b642-ffb158cf6a49","seq":1,"duration_ms":100,"bytes_in":453,"bytes_out":14,"enriched":{"digest":"7c0e921bd71aa38c","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=2ca0b6057","Via: SIP/2.0/TCP 10.116.4.57:64911;branch=z9hG4bK-d87543-103883201-1--d87543;rpo…","Call-ID: 36ee314175a64537a5459f383d1ca723","CSeq: 1 REGISTER","Contact: <sip:100@10.116.4.57:64911>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["10.116.4.57"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-11T08:44:43","port":5087,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=2fe54efdf\r\nVia: SIP/2.0/TCP 10.116.4.57:55360;branch=z9hG4bK-d87543-343744894-1--d87543;rport\r\nCall-ID: 02ee7350bb0f40779147cf39f33a1154\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@10.116.4.57:55360>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d3266653534656664660d0a5669613a205349502f322e302f5443502031302e3131362e342e35373a35353336303b6272616e63683d7a39684734624b2d6438373534332d3334333734343839342d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2030326565373335306262306634303737393134376366333966333361313135340d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130304031302e3131362e342e35373a35353336303e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"9b114522-11af-40ec-a7b2-b51de4c630c9","seq":1,"duration_ms":100,"bytes_in":456,"bytes_out":14,"enriched":{"digest":"0a9af51f11f63bc9","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=2fe54efdf","Via: SIP/2.0/TCP 10.116.4.57:55360;branch=z9hG4bK-d87543-343744894-1--d87543;rpo…","Call-ID: 02ee7350bb0f40779147cf39f33a1154","CSeq: 1 REGISTER","Contact: <sip:100@10.116.4.57:55360>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["10.116.4.57"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-11T08:43:49","port":5091,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=8ac2d17ef\r\nVia: SIP/2.0/TCP 10.116.4.57:62081;branch=z9hG4bK-d87543-532465090-1--d87543;rport\r\nCall-ID: a815ec2c2fda4f0fa8075b035b64f4f2\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@10.116.4.57:62081>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d3861633264313765660d0a5669613a205349502f322e302f5443502031302e3131362e342e35373a36323038313b6272616e63683d7a39684734624b2d6438373534332d3533323436353039302d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2061383135656332633266646134663066613830373562303335623634663466320d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130304031302e3131362e342e35373a36323038313e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"cbd9f8d0-8b55-4075-a03e-5ceec9d2595f","seq":1,"duration_ms":100,"bytes_in":453,"bytes_out":14,"enriched":{"digest":"0c9df20edcf58f53","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=8ac2d17ef","Via: SIP/2.0/TCP 10.116.4.57:62081;branch=z9hG4bK-d87543-532465090-1--d87543;rpo…","Call-ID: a815ec2c2fda4f0fa8075b035b64f4f2","CSeq: 1 REGISTER","Contact: <sip:100@10.116.4.57:62081>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["10.116.4.57"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-11T08:33:12","port":5086,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=9b6e27a10\r\nVia: SIP/2.0/TCP 10.116.4.57:63828;branch=z9hG4bK-d87543-278005568-1--d87543;rport\r\nCall-ID: b93b28f71a8d49e3b60eafe5f68b62ce\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@10.116.4.57:63828>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d3962366532376131300d0a5669613a205349502f322e302f5443502031302e3131362e342e35373a36333832383b6272616e63683d7a39684734624b2d6438373534332d3237383030353536382d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2062393362323866373161386434396533623630656166653566363862363263650d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130304031302e3131362e342e35373a36333832383e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"20c5f895-4df2-495a-b051-63b27f97f073","seq":1,"duration_ms":100,"bytes_in":456,"bytes_out":14,"enriched":{"digest":"202c0e581fc3f1d2","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=9b6e27a10","Via: SIP/2.0/TCP 10.116.4.57:63828;branch=z9hG4bK-d87543-278005568-1--d87543;rpo…","Call-ID: b93b28f71a8d49e3b60eafe5f68b62ce","CSeq: 1 REGISTER","Contact: <sip:100@10.116.4.57:63828>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["10.116.4.57"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-11T08:25:30","port":5080,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=57d998ca8\r\nVia: SIP/2.0/TCP 10.116.4.57:52998;branch=z9hG4bK-d87543-777420111-1--d87543;rport\r\nCall-ID: 2a291dfb390f4be0ab7684def40dc0e8\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@10.116.4.57:52998>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d3537643939386361380d0a5669613a205349502f322e302f5443502031302e3131362e342e35373a35323939383b6272616e63683d7a39684734624b2d6438373534332d3737373432303131312d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2032613239316466623339306634626530616237363834646566343064633065380d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130304031302e3131362e342e35373a35323939383e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"0cc06957-90c6-453b-9c7f-e31d5e6dc118","seq":1,"duration_ms":100,"bytes_in":453,"bytes_out":14,"enriched":{"digest":"56781412277aca52","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=57d998ca8","Via: SIP/2.0/TCP 10.116.4.57:52998;branch=z9hG4bK-d87543-777420111-1--d87543;rpo…","Call-ID: 2a291dfb390f4be0ab7684def40dc0e8","CSeq: 1 REGISTER","Contact: <sip:100@10.116.4.57:52998>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["10.116.4.57"],"paths":["/2.0/TCP"]}}},{"timestamp":"2026-08-11T08:22:01","port":5092,"proto":"tcp","app_proto":"","app_protocol":"sip","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nTo: <sip:100@<HONEYPOT>>\r\nFrom: <sip:100@<HONEYPOT>>;tag=4b3a209cf\r\nVia: SIP/2.0/TCP 10.116.4.57:51079;branch=z9hG4bK-d87543-352020135-1--d87543;rport\r\nCall-ID: a69653f1b6bb45e09e2572d3c74a768f\r\nCSeq: 1 REGISTER\r\nContact: <sip:100@10.116.4.57:51079>\r\nExpires: 3600\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO\r\nUser-Agent: Yealink\r\nContent-Length: 0\r\n\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a546f3a203c7369703a31303040<HONEYPOT>3e0d0a46726f6d3a203c7369703a31303040<HONEYPOT>3e3b7461673d3462336132303963660d0a5669613a205349502f322e302f5443502031302e3131362e342e35373a35313037393b6272616e63683d7a39684734624b2d6438373534332d3335323032303133352d312d2d6438373534333b72706f72740d0a43616c6c2d49443a2061363936353366316236626234356530396532353732643363373461373638660d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a3130304031302e3131362e342e35373a35313037393e0d0a457870697265733a20333630300d0a4d61782d466f7277617264733a2037300d0a416c6c6f773a20494e564954452c2041434b2c2043414e43454c2c204f5054494f4e532c204259452c2052454645522c204e4f544946592c204d4553534147452c205355425343524942452c20494e464f0d0a557365722d4167656e743a205965616c696e6b0d0a436f6e74656e742d4c656e6774683a20300d0a0d0a0d0a","method":"","user_agent":"","ja3":"","session":"8c23f351-7323-466c-bf2f-aa924935ad01","seq":1,"duration_ms":100,"bytes_in":456,"bytes_out":14,"enriched":{"digest":"6fb3b5448693d73f","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","To: <sip:100@<HONEYPOT>>","From: <sip:100@<HONEYPOT>>;tag=4b3a209cf","Via: SIP/2.0/TCP 10.116.4.57:51079;branch=z9hG4bK-d87543-352020135-1--d87543;rpo…","Call-ID: a69653f1b6bb45e09e2572d3c74a768f","CSeq: 1 REGISTER","Contact: <sip:100@10.116.4.57:51079>","Expires: 3600","Max-Forwards: 70","Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INF…"],"iocs":{"ips":["10.116.4.57"],"paths":["/2.0/TCP"]}}}],"http_methods":[],"distinct_ports_total":18,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T05:42:05.375908+00:00"}